I've been dealing with this for what seems like ages now. At my last job I actually had to go a get a new service shut down because the people who provisioned it didn't realise or understand that it was a problem that all the PID was being stored in the US.

I've read the Safe Harbor rules and audit information and I don't trust it one bit. I really can't blame corporations, especially EU ones, from stating very plainly that they don't want their data stored in the US.